General

  • Target

    b98cf84db0bb1f68a1bb7c30b7ee682a824999a21658adc9888b43b75f00d625.exe

  • Size

    1.6MB

  • Sample

    250123-lpfamawjar

  • MD5

    2225e9267b14df2fd2ed645129987198

  • SHA1

    a5ed36ce35337b95f520428fa29b35244ef822e0

  • SHA256

    b98cf84db0bb1f68a1bb7c30b7ee682a824999a21658adc9888b43b75f00d625

  • SHA512

    59e87f660af109591a8e1035564de41f343490f1c74844f6b98b53f1425d1d41dd6401db71780a786da9d996a65ba3ac07b42e2dc3894eea1d9565b14ba45568

  • SSDEEP

    12288:WB5a3hizhz/o456rn9lkQ8rxQslgBKR1jl9RL9BVnDXLmoIY7Tm+jZFluq9wd4UB:WkB4tpHlgGjlLHlFoq2d5B

Malware Config

Targets

    • Target

      b98cf84db0bb1f68a1bb7c30b7ee682a824999a21658adc9888b43b75f00d625.exe

    • Size

      1.6MB

    • MD5

      2225e9267b14df2fd2ed645129987198

    • SHA1

      a5ed36ce35337b95f520428fa29b35244ef822e0

    • SHA256

      b98cf84db0bb1f68a1bb7c30b7ee682a824999a21658adc9888b43b75f00d625

    • SHA512

      59e87f660af109591a8e1035564de41f343490f1c74844f6b98b53f1425d1d41dd6401db71780a786da9d996a65ba3ac07b42e2dc3894eea1d9565b14ba45568

    • SSDEEP

      12288:WB5a3hizhz/o456rn9lkQ8rxQslgBKR1jl9RL9BVnDXLmoIY7Tm+jZFluq9wd4UB:WkB4tpHlgGjlLHlFoq2d5B

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks